Privacy policy

Data controller

The data controller is Hotel Miralago, located in Bossico. Privacy requests can be sent using the contact details published on the Contact page.

Data processed

We may process browsing data, technical preferences, data entered in contact or request forms, contact details, message content and information needed to reply.

The website may link to external services, such as the BookingExpert booking engine, which process data under their own privacy notices.

Purposes and legal bases

Data is processed to reply to requests, manage pre-contractual or contractual information, ensure security and proper website operation, comply with legal obligations and measure website use through analytics only after consent.

Depending on the case, the legal bases are pre-contractual or contractual measures, legal obligations, legitimate interest in website security and technical management, and consent for non-essential analytics.

Cookies, analytics and external services

The website uses technical cookies required for operation, including language preference and storage of cookie choices.

Google Analytics 4 is managed through Google Tag Manager and is enabled only after consent to analytics cookies. Before consent, analytics consent is set to denied.

Google Maps may be displayed directly on contact and location pages to make the address easier to use. When the map loads, the browser may connect to Google services according to Google policies and settings.

Retention

Data sent through forms or email is kept for the time needed to manage the request and any subsequent relationship, unless longer legal retention periods apply.

Cookie preferences are stored so that the choice is not requested on every visit. Analytics data follows the retention settings configured in Google services.

Recipients and transfers

Data may be processed by technical providers, hosting providers, booking platforms, email services, website maintainers and other parties needed to provide the requested services.

Some providers, including Google and other digital services, may process data outside the European Economic Area. In such cases transfers are carried out under the safeguards required by the GDPR.

Data subject rights

Data subjects may request access, rectification, erasure, restriction, objection and portability where provided by the GDPR.

Consent to analytics cookies can be withdrawn at any time through the banner or cookie preferences. Users also have the right to lodge a complaint with the Italian Data Protection Authority.